zevairouter 1.0.184 → 1.0.185

package/cli/app/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Unreleased
 
+# v1.0.185 (2026-08-02)
+
+## Fixes
+- **Restoring a backup no longer deletes all usage history**: `importDb()` cleared every table in the schema, including the three that `exportDb()` deliberately omits to keep backups small (`usageHistory`, `requestDetails`, `quotaCache`). Since the payload carries no rows for them, restoring a config backup permanently wiped all usage and request history. Those tables are now left untouched during a restore.
+- **API key budgets are enforced regardless of `requireApiKey`**: the daily/monthly budget check sat inside the `requireApiKey` branch while rate limits and model policy applied to any recognized key, so turning `requireApiKey` off silently disabled spend caps. Budget enforcement is now keyed on the request carrying an API key, matching the other per-key limits.
+- **A dropped stream no longer locks a budgeted API key out permanently**: the single-in-flight slot that serializes budgeted requests was released only by SSE stream completion, so a client that neither drained nor cancelled its stream pinned the slot until the process restarted and every later request for that key returned 429. Slots now expire, and a late release cannot free a slot a newer request has since claimed.
+- **Web-shell tokens are no longer accepted as dashboard sessions**: `terminal_token` and `auth_token` are signed with the same secret, so a bare signature check let a 4-hour terminal token act as a 24-hour dashboard session. Both readers now require the `authenticated` claim that only dashboard login issues.
+- **Dashboard logins survive a browser restart**: the `auth_token` cookie had no `maxAge`, so a still-valid 24-hour session was discarded when the browser closed. The cookie lifetime now matches the token's.
+- **The MITM proxy is no longer orphaned on port 443**: the proxy runs as root via `sudo`, so liveness checks from the unprivileged dashboard get `EPERM`, which was treated as "not running". Status checks deleted the PID file of a live process, and stop reported success without the process exiting. `EPERM` now correctly means "alive".
+- **MITM runtime server picks up new releases**: the copy was skipped whenever the bundled and installed `server.js` had the same byte size, so a new release of identical length kept running the old bundle. Modification time is now compared as well.
+
+## Improvements
+- **Faster writes on the sql.js fallback driver**: every standalone write serialized the entire database twice — once for a rollback copy, once to persist. Recovery now reads back the last persisted file instead, since it already matches memory whenever no write is in flight, halving the per-write cost.
+
 # v1.0.184 (2026-08-01)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.184",
+  "version": "1.0.185",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"

package/cli/app/src/lib/db/adapters/nodeSqliteAdapter.js

@@ -16,7 +16,14 @@ export async function createNodeSqliteAdapter(filePath) {
   };
 
   // Dynamic import — fails on Node < 22.5 → driver.js falls back to sql.js
-  const sqlite = await import("node:sqlite");
+  // The warning only fires during import, so restore process.emit immediately
+  // instead of leaving the whole process patched for its entire lifetime.
+  let sqlite;
+  try {
+    sqlite = await import("node:sqlite");
+  } finally {
+    process.emit = origEmit;
+  }
   const Database = sqlite.DatabaseSync;
   const db = new Database(filePath);
 

package/cli/app/src/lib/db/adapters/sqljsAdapter.js

@@ -89,16 +89,34 @@ export async function createSqlJsAdapter(filePath, options = {}) {
     try { previous.close(); } catch {}
   }
 
+  // Rewind memory to the last image that reached disk. Whenever no write is in
+  // progress the file matches in-memory state, so the file *is* the known-good
+  // snapshot. Reading it back only on failure avoids the db.export() that used
+  // to run before every single write — that cost two whole-database
+  // serialisations per INSERT, one for the rollback copy and one for persist().
+  function rewindToPersistedImage(cause) {
+    let image = null;
+    try {
+      if (fs.existsSync(filePath)) image = fs.readFileSync(filePath);
+    } catch (readError) {
+      // Memory holds writes the file does not and the last good image cannot be
+      // rebuilt. Surface both failures rather than continuing on a database that
+      // silently disagrees with disk.
+      cause.rewindError = readError;
+      throw cause;
+    }
+    restoreSnapshot(image);
+  }
+
   function runWithPersistence(operation) {
     if (transactionDepth > 0) return operation();
 
-    const snapshot = db.export();
     try {
       const result = operation();
       persist();
       return result;
     } catch (error) {
-      restoreSnapshot(snapshot);
+      rewindToPersistedImage(error);
       throw error;
     }
   }
@@ -153,7 +171,6 @@ export async function createSqlJsAdapter(filePath, options = {}) {
   function transaction(fn) {
     const sp = `sp_${Math.random().toString(36).slice(2)}`;
     const outermost = transactionDepth === 0;
-    const snapshot = outermost ? db.export() : null;
     db.exec(`SAVEPOINT ${sp}`);
     transactionDepth++;
     let released = false;
@@ -171,8 +188,13 @@ export async function createSqlJsAdapter(filePath, options = {}) {
         transactionDepth--;
         try { db.exec(`ROLLBACK TO ${sp}`); db.exec(`RELEASE ${sp}`); } catch {}
       }
-      if (snapshot) {
-        restoreSnapshot(snapshot);
+      // ROLLBACK TO undoes the savepoint's own statements, but only an outermost
+      // transaction can rewind memory to the persisted image: a nested one must
+      // leave its parent's uncommitted work intact. RELEASE means the savepoint
+      // closed in WASM memory while nothing reached disk, so the rewind is what
+      // keeps memory from holding rows the file does not.
+      if (outermost) {
+        rewindToPersistedImage(e);
       }
       throw e;
     }

package/cli/app/src/mitm/server.js

@@ -52,7 +52,7 @@ ${i}
 `).replace(/'/g,"'\\''");await Vr(`printf '%s' '${o}' | tee ${Ze} > /dev/null`,t),await Zo(t)}Sa(`\u{1F310} DNS ${e}: \u2705 removed ${r.join(", ")}`)}catch(n){let s=n.message?.includes("incorrect password")?"Wrong sudo password":`Failed to remove DNS entry: ${n.message}`;throw new Error(s)}}async function Bd(e){for(let t of Object.keys(Kt))try{await eu(t,e)}catch(a){Sd(`DNS ${t}: failed to remove \u2014 ${a.message}`)}}function bd(){try{if(!_e.existsSync(Ze))return;let e=Object.values(Kt).flat(),t=_e.readFileSync(Ze,"utf8"),a=bt?`\r
 `:`
 `,n=t.split(/\r?\n/).filter(s=>!e.some(i=>s.includes(i))).join(a).replace(/[\r\n\s]+$/g,"")+a;if(n===t)return;if(_e.writeFileSync(Ze,n,"utf8"),bt)try{Or("ipconfig /flushdns",{windowsHide:!0,stdio:"ignore"})}catch{}else if(Xo)try{Or("dscacheutil -flushcache && killall -HUP mDNSResponder",{stdio:"ignore"})}catch{}else try{Or("resolvectl flush-caches 2>/dev/null || true",{stdio:"ignore"})}catch{}}catch{}}tu.exports={TOOL_HOSTS:Kt,addDNSEntry:Ad,removeDNSEntry:eu,removeAllDNSEntries:Bd,removeAllDNSEntriesSync:bd,execWithPassword:Vr,isSudoAvailable:Ta,canRunSudoWithoutPassword:Jo,isSudoPasswordRequired:Td,checkDNSEntry:wn,checkAllDNSStatus:Id}});var fu=require("https"),_d=require("http2"),cu=require("tls"),au=require("fs"),nu=require("path"),Nd=require("dns"),{promisify:wd}=require("util"),{execSync:Rn}=require("child_process"),{log:Un,err:ot,dumpRequest:Rd,createResponseDumper:Ld,clearDumpDir:kd}=Gt(),{IS_DEV:Dd,LSOF_BIN:Ud,TARGET_HOSTS:Pd,URL_PATTERNS:Od,MODEL_SYNONYMS:Vd,MODEL_PATTERNS:Fd,MODEL_NO_MAP:Kd,getToolForHost:du}=Er(),{DATA_DIR:hp,MITM_DIR:iu}=rr(),{getCertForDomain:Md}=vo(),{getMitmAlias:qd}=xo(),{applyAntigravityIdeVersionOverride:Hd}=Io(),Cr=443,su=process.platform==="win32",hu=Dd;kd();var ou={name:"x-request-source",value:"local"},Gd={"cloudcode-pa.googleapis.com":"daily-cloudcode-pa.googleapis.com"},uu={antigravity:No(),copilot:Ro(),kiro:Oo(),cursor:Fo()},Ln=new Map,pu;function zd(e,t){try{if(Ln.has(e))return t(null,Ln.get(e));let a=Md(e);if(!a)return t(new Error(`Failed to generate cert for ${e}`));let r=require("tls").createSecureContext({key:a.key,cert:`${a.cert}
-${pu}`});Ln.set(e,r),t(null,r)}catch(a){ot(`SNI error for ${e}: ${a.message}`),t(a)}}var gu;try{let e=au.readFileSync(nu.join(iu,"rootCA.key")),t=au.readFileSync(nu.join(iu,"rootCA.crt"));pu=t.toString("utf8"),gu={key:e,cert:t,SNICallback:zd}}catch(e){ot(`Root CA not found: ${e.message}`),process.exit(1)}var kn={},Qd=300*1e3;async function Pn(e){let t=kn[e];if(t&&Date.now()-t.ts<Qd)return t.ip;let a=new Nd.Resolver;a.setServers(["8.8.8.8"]);let n=await wd(a.resolve4.bind(a))(e);return kn[e]={ip:n[0],ts:Date.now()},kn[e].ip}function Yd(e){return new Promise((t,a)=>{let r=[];e.on("data",n=>r.push(n)),e.on("end",()=>t(Buffer.concat(r))),e.on("error",a)})}function $d(e,t){let a=e.match(/\/models\/([^/:]+)/);if(a)return a[1];if(jd(t))return null;try{let r=JSON.parse(t.toString());return r.conversationState?r.conversationState.currentMessage?.userInputMessage?.modelId||null:r.model||null}catch{return null}}function jd(e){if(!e||e.length===0)return!1;let t=e.slice(0,Math.min(100,e.length)),a=0;for(let r=0;r<t.length;r++){let n=t[r];n<32&&n!==9&&n!==10&&n!==13&&a++,n>126&&a++}return a/t.length>.3}function Wd(e,t){if(!t)return null;try{let a=qd(e);if(!a)return null;let r=String(t).replace(/^models\//,""),n=Vd?.[e]?.[r]||r;if(a[n])return a[n];let s=Object.keys(a).find(o=>o&&a[o]&&(n.startsWith(o)||o.startsWith(n)));if(s)return a[s];let i=Fd?.[e]||[];for(let{match:o,alias:u}of i)if(o.test(n)&&a[u])return a[u];return null}catch{return null}}async function er(e,t,a,r){let n=(e.headers.host||Pd[0]).split(":")[0],i=(e.url.includes(":generateContent")||e.url.includes(":streamGenerateContent"))&&Gd[n]||n,o=hu?Ld(e,"passthrough"):null,l=du(e.headers.host)==="antigravity"?Hd(a,e.headers):{bodyBuffer:a,headers:e.headers},f=l.bodyBuffer,c={...l.headers,host:i};f!==a&&(c["content-length"]=String(f.length));try{if(await Xd(i)==="h2")return await Jd(e,t,f,c,i,r,o)}catch(g){ot(`[mitm] ALPN negotiate failed: ${g.message}, fallback to HTTP/1.1`)}return Zd(e,t,f,c,i,r,o)}var Dn=new Map;async function Xd(e){if(Dn.has(e))return Dn.get(e);let t=await Pn(e);return new Promise((a,r)=>{let n=cu.connect({host:t,port:443,servername:e,ALPNProtocols:["h2","http/1.1"],rejectUnauthorized:!1},()=>{let s=n.alpnProtocol||"http/1.1";Dn.set(e,s),Un(`\u{1F517} [mitm] ALPN ${e} \u2192 ${s}`),n.end(),a(s)});n.once("error",r),n.setTimeout(5e3,()=>{n.destroy(new Error("ALPN timeout"))})})}async function Jd(e,t,a,r,n,s,i){let o=await Pn(n),u={};for(let[l,f]of Object.entries(r)){let c=l.toLowerCase();c==="host"||c==="connection"||c==="keep-alive"||c==="transfer-encoding"||c==="upgrade"||c==="proxy-connection"||(u[c]=f)}return u[":method"]=e.method,u[":path"]=e.url,u[":scheme"]="https",u[":authority"]=n,new Promise(l=>{let f=_d.connect(`https://${n}`,{createConnection:()=>cu.connect({host:o,port:443,servername:n,ALPNProtocols:["h2"],rejectUnauthorized:!1})});f.once("error",g=>{ot(`[mitm] http2 client error: ${g.message}`),i&&(i.writeChunk(`
+${pu}`});Ln.set(e,r),t(null,r)}catch(a){ot(`SNI error for ${e}: ${a.message}`),t(a)}}var gu;try{let e=au.readFileSync(nu.join(iu,"rootCA.key")),t=au.readFileSync(nu.join(iu,"rootCA.crt"));pu=t.toString("utf8"),gu={key:e,cert:t,SNICallback:zd}}catch(e){ot(`Root CA not found: ${e.message}`),process.exit(1)}var kn={},Qd=300*1e3;async function Pn(e){let t=kn[e];if(t&&Date.now()-t.ts<Qd)return t.ip;let a=new Nd.Resolver;a.setServers(["8.8.8.8"]);let n=await wd(a.resolve4.bind(a))(e);return kn[e]={ip:n[0],ts:Date.now()},kn[e].ip}function Yd(e){return new Promise((t,a)=>{let r=[];e.on("data",n=>r.push(n)),e.on("end",()=>t(Buffer.concat(r))),e.on("error",a)})}function $d(e,t){let a=e.match(/\/models\/([^/:]+)/);if(a)return a[1];if(jd(t))return null;try{let r=JSON.parse(t.toString());return r.conversationState?r.conversationState.currentMessage?.userInputMessage?.modelId||null:r.model||null}catch{return null}}function jd(e){if(!e||e.length===0)return!1;let t=e.slice(0,Math.min(100,e.length)),a=0;for(let r=0;r<t.length;r++){let n=t[r];(n>=0&&n<=8||n>=11&&n<=12||n>=14&&n<=31||n===127)&&a++}return a/t.length>.3}function Wd(e,t){if(!t)return null;try{let a=qd(e);if(!a)return null;let r=String(t).replace(/^models\//,""),n=Vd?.[e]?.[r]||r;if(a[n])return a[n];let s=Object.keys(a).find(o=>o&&a[o]&&(n.startsWith(o)||o.startsWith(n)));if(s)return a[s];let i=Fd?.[e]||[];for(let{match:o,alias:u}of i)if(o.test(n)&&a[u])return a[u];return null}catch{return null}}async function er(e,t,a,r){let n=(e.headers.host||Pd[0]).split(":")[0],i=(e.url.includes(":generateContent")||e.url.includes(":streamGenerateContent"))&&Gd[n]||n,o=hu?Ld(e,"passthrough"):null,l=du(e.headers.host)==="antigravity"?Hd(a,e.headers):{bodyBuffer:a,headers:e.headers},f=l.bodyBuffer,c={...l.headers,host:i};f!==a&&(c["content-length"]=String(f.length));try{if(await Xd(i)==="h2")return await Jd(e,t,f,c,i,r,o)}catch(g){ot(`[mitm] ALPN negotiate failed: ${g.message}, fallback to HTTP/1.1`)}return Zd(e,t,f,c,i,r,o)}var Dn=new Map;async function Xd(e){if(Dn.has(e))return Dn.get(e);let t=await Pn(e);return new Promise((a,r)=>{let n=cu.connect({host:t,port:443,servername:e,ALPNProtocols:["h2","http/1.1"],rejectUnauthorized:!1},()=>{let s=n.alpnProtocol||"http/1.1";Dn.set(e,s),Un(`\u{1F517} [mitm] ALPN ${e} \u2192 ${s}`),n.end(),a(s)});n.once("error",r),n.setTimeout(5e3,()=>{n.destroy(new Error("ALPN timeout"))})})}async function Jd(e,t,a,r,n,s,i){let o=await Pn(n),u={};for(let[l,f]of Object.entries(r)){let c=l.toLowerCase();c==="host"||c==="connection"||c==="keep-alive"||c==="transfer-encoding"||c==="upgrade"||c==="proxy-connection"||(u[c]=f)}return u[":method"]=e.method,u[":path"]=e.url,u[":scheme"]="https",u[":authority"]=n,new Promise(l=>{let f=_d.connect(`https://${n}`,{createConnection:()=>cu.connect({host:o,port:443,servername:n,ALPNProtocols:["h2"],rejectUnauthorized:!1})});f.once("error",g=>{ot(`[mitm] http2 client error: ${g.message}`),i&&(i.writeChunk(`
 [ERROR h2] ${g.message}
 `),i.end()),t.headersSent||t.writeHead(502),t.writableEnded||t.end("Bad Gateway");try{f.close()}catch{}l()});let c=f.request(u,{endStream:a.length===0});a.length>0&&c.end(a),c.once("response",g=>{let v=g[":status"],y={};for(let[S,I]of Object.entries(g))S.startsWith(":")||S==="connection"||S==="keep-alive"||S==="transfer-encoding"||(y[S]=I);t.writeHead(v,y),i&&i.writeHeader(v,y);let x=[];c.on("data",S=>{i&&i.writeChunk(S),s&&x.push(S),t.write(S)}),c.on("end",()=>{if(i&&i.end(),t.writableEnded||t.end(),s)try{s(Buffer.concat(x),y)}catch{}try{f.close()}catch{}l()})}),c.once("error",g=>{ot(`[mitm] http2 stream error: ${g.message}`),i&&(i.writeChunk(`
 [ERROR h2-stream] ${g.message}

package/cli/cli.js

@@ -948,11 +948,17 @@ function sleepSync(ms) {
   try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch { /* ignore */ }
 }
 
-// Wait until process dies or timeout reached
+// Wait until process dies or timeout reached.
+// ESRCH means gone; EPERM/EACCES means alive but owned by another user (the MITM
+// server runs as root), so it must NOT count as exited or callers skip the
+// SIGKILL escalation and report a stop that never happened.
 function waitForExit(pid, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    try { process.kill(pid, 0); } catch { return true; }
+    try { process.kill(pid, 0); }
+    catch (err) {
+      if (err.code !== "EPERM" && err.code !== "EACCES") return true;
+    }
     sleepSync(100);
   }
   return false;

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.184",
+  "version": "1.0.185",
   "private": true,
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.184",
+  "version": "1.0.185",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"